- Freeradius-Users - lists.freeradius.org

Strange behaviour
by Ellad G. Yatsko 30 Jan '20

30 Jan '20

Hello! I faced a strange problem while setting up PEAP/TLS with FreeRADIUS as a Proxy for Windows NPS (2012R). Wireless Client -->> AccessPoint -->> FreeRADIUS -->> NPS (iOS,Android,Win) Cisco/Motorola/Unifi Ubuntu 16.04 Win2012R FreeRADIUS is set up and waiting for requests. When Wireless Client is trying to authenticate it seems FreeRADIUS tries to proxy request to NPS Request/Challenges begins and sometimes the process stucks in this exchange sometimes NPS and subsequently FreeRADIUS Access-Accepts and authenticates user. I supply relevant FreeRADIUS logs and I'm ready to provide configs and so on. May you help me to understand what's wrong with me? The impression FreeRADIUS interprets some packets incorrectly. The matter I think is in my settings which is got from numerous articles from Internet. FreeRADIUS Version 2.2.8 /etc/freeradius/sites-available/default: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ authorize { chap mschap digest ntdomain eap { ok = return } if ( ! (realm == "ponyex.local") ) { files if (noop) { sql if (notfound) { update control { Proxy-To-Realm := "ponyex.local" } } } } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } pre-proxy { update proxy-request { Connect-Info := "This is a Friendly-Name" } } /etc/freeradius/proxy.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ home_server nps { type = auth ipaddr = 10.0.0.179 port = 1812 secret = *************************** require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = request username = "test_user_please_reject_me" password = "this is really secret" num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool ponyex_pool { type = fail-over home_server = nps } realm ponyex.local { auth_pool = ponyex_pool nostrip } /etc/freeradius/eap.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~ eap { default_eap_type = tls peap timer_expire = 60 tls { # Domains Cert/Key private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${cadir}/ca.crt } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } mschapv2 { } /etc/freeradius/modules/mschap: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } /etc/freeradius/modules/realm: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } Kind regards, Ellad

3 2

Two different user-names while using computer authentification with client certificate
by uj2.hahn＠posteo.de 29 Jan '20

29 Jan '20

Hi! I have a question just for my understanding. I installed a Radius client certificate (RadiusClient) on a Win10 client and enabled user authentification on this WLAN profile. This all works fine. Just for my education I switched the client WLAN profile to computer (!) authentification (instead of user), just to see what will happen with freeradius. First thing I saw is: (7) Received Access-Request Id 152 from 192.168.188.45:37569 to 192.168.188.50:1812 length 226 (7) User-Name = "host/RadiusClient" (7) NAS-IP-Address = 192.168.1.245 (7) NAS-Port = 0 (7) Called-Station-Id = "88-90-8D-42-55-70:ciscosb" So User-Name changed from RadiusClient to host/RadiusClient which I understood. But later in the same session I saw: 7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - host/DESKTOP-FLOQN5Q (7) eap_peap: Got inner identity 'host/DESKTOP-FLOQN5Q' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0207001901686f73742f4445534b544f502d464c4f514e3551 (7) eap_peap: Setting User-Name to host/DESKTOP-FLOQN5Q (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0207001901686f73742f4445534b544f502d464c4f514e3551 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "host/DESKTOP-FLOQN5Q" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0207001901686f73742f4445534b544f502d464c4f514e3551 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "host/DESKTOP-FLOQN5Q" Now the User-Name is the real PC hostname "host/DESKTOP-FLOQN5Q". So it seems the outer and the inner tunnel see different User-Names. Is this on intention? Any chance to have one User-Name only, e.g. the client certificate name: RadiusClient. Thanks Uwe

3 4

Telling FR to conect to postres vi IPv4
by Alex Sharaz 29 Jan '20

29 Jan '20

Hi, Our database team have just migrated a postgres db from Ubuntu 15.04 -> 18.04 postgres 10 my FR server ( Ubuntu 16.04 / FR 3.0.20) has had dual ip stacks for ages but I guess the postgres db server hasn't The new server does have ipv6 and now FR is trying to connect to it via ipv6.... and is getting rejected Two options 1). Set postgres up to accept connections from the new ipv6 address 2). Tell the FR end to use ipv4 Fairly certain its not a FR thing but underlying postgres config. So how do I tell my FR server to connect via ipv4 ? Rgds A

2 2

module fails parsing output, expecting operator
by Richard Green 29 Jan '20

29 Jan '20

I am seeking help with an error parsing the output from an external exec program with FreeRADIUS 3 (a similar configuration, albeit some file movements for the updated config, worked without a problem with FreeRADIUS 2). The external exec program (/usr/local/bin/multiotp.php) seem to return a valid response (which is the same as for the working configuration for version 2), however FreeRADIUS 3 reports a parsing error at this point. I've been using successfully using FreeRADIUS 2 for a while with MultiOTP to provide an authentication component where the password is a TOTP token and the username is synchronised with an Active Directory and am attempting to upgrade to FreeRADIUS 3. My debug log is as follows: . . . (1) auth_log: --> Mon Jan 27 09:08:08 2020 (1) [auth_log] = ok (1) [chap] = noop (1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "johnboy", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [expiration] = noop (1) [logintime] = noop (1) multiotp: Executing: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: (1) multiotp: EXPAND %{User-Name} (1) multiotp: --> johnboy (1) multiotp: EXPAND %{User-Password} (1) multiotp: --> (1) multiotp: EXPAND -src=%{Packet-Src-IP-Address} (1) multiotp: --> -src=127.0.0.1 (1) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge} (1) multiotp: --> -chap-challenge= (1) multiotp: EXPAND -chap-password=%{CHAP-Password} (1) multiotp: --> -chap-password= (1) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge} (1) multiotp: --> -ms-chap-challenge=0x5c1ed153a00f704f [8/1872] (1) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response} (1) multiotp: --> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000e6a71cf3f91b0c6218c456823e92d63ff58359976f0c272a (1) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response} (1) multiotp: --> -ms-chap2-response= (1) multiotp: ERROR: Failed parsing output from: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: Expecting opera tor (1) multiotp: ERROR: Program returned code (0) and output 'Filter-Id += "Erica-Users",NT_KEY: EBEEE229885004ACEA55894DFDC1272D ' (1) [multiotp] = fail (1) } # authorize = fail (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { . . . (Note the wiki page https://wiki.freeradius.org/guide/multiOTP-HOWTO discusses version 3 but seems to reference version 2 file names, so is only useful as a guideline). Thanks! Richard Green UNSW Sydney

2 2

Can an EAP-over-RADIUS request ever result in an Access-Reject?
by Joe Garcia 28 Jan '20

28 Jan '20

The reason for that question is based on RFC 3579, section 3.2: It [Message-Authenticator] MUST be used in any Access-Request, Access- Accept, Access-Reject or Access-Challenge that includes an EAP-Message attribute. A RADIUS server receiving an Access-Request with a Message- Authenticator attribute present MUST calculate the correct value of the Message-Authenticator and silently discard the packet if it does not match the value sent. What this would mean in practice is that any EAP authentication request with an incorrect password will be silently dropped, so there's no possibility of ever seeing an Access-Reject. I know what the Message-Authenticator is meant for, but since I'm just using EAP as a transport layer for a TLS tunnel its presence is irrelevant. Is this behavior really how it works? How can you use an authentication mechanism for which the behavior for an incorrect password is indistinguishable from a network error? JG.

3 4

run script on dhcp events
by Семёнов Евгений Владими рович 27 Jan '20

27 Jan '20

Hello, how can I run a script when the freeradius dhcp server returns the address back to the ip-pool? -- Evgeniy

3 6

Windows 10 EAP-TTLS with client certificate
by Ján Máté 27 Jan '20

27 Jan '20

Hi list, I successfully installed and configured our FreeRADIUS server with the following results: EAP-TLS => works on Windows 10, iOS 13, macOS 10.15 (Catalina) EAP-TTLS + PAP (LDAP auth) => works on Windows 10, iOS 13, macOS 10.15 EAP-TTLS + PAP (LDAP auth) + client cert => NOT works on Windows 10, but works on iOS 13, macOS 10.15 The last option with Windows 10 produces the following error logs: (185) eap_ttls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (185) eap_ttls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (185) eap_ttls: ERROR: System call (I/O) error (-1) (185) eap_ttls: ERROR: TLS receive handshake failed during operation (185) eap_ttls: ERROR: [eaptls process] = fail (185) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed Windows 10 logs: Wireless 802.1x authentication failed. Error: 0x80420015 EAP Reason: 0x80420015 EAP Root cause String: EAP Error: 0x80420015 I tried nearly all combinations in the Windows 10 configuration interface, but it never sends the client_cert with EAP-TTLS (the same settings with EAP-TLS work). When trying to connect to Wi-FI the Windows 10 interface looks like: Choose a certificate: <correctly pre-selected certificate> User name: <my username entered manually> but after clicking to connect the server never receives the selected certificate ... Is the optional "client cert" in EAP-TTLS supported on Windows 10? Any ideas to get it working? Thanks, JM

5 8

Grant access to a groups of users to a determinated subnets
by Condor 27 Jan '20

27 Jan '20

Hi all, sorry for bother again, i like to grant access to a groups of users to a determinated subnets. For example: In clients: client 192.168.0.0/16 { ipaddr = 192.168.0.0/16 shortname = LAN secret = ****} In users: test003 Crypt-Password := "$1$Z71rzgee$ZIJbcaMDyHtUtKN/", Huntgroup-Name == gNetworking, Huntgroup-Name == Servers Auth-Type = System, Service-Type = Login, Reply-Message = "Hello Test003", (user: test003 belong to two huntgroups) In huntgroups:Servers NAS-IP-Address =~ "/^172\.16\.0\.(1?\d\d?|2[0-4]\d|25[0-5])$/" gNetworking NAS-IP-Address =~ /^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/ Trying also (gNetworking NAS-IP-Address =~ "/^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/")Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])) Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5]), NAS-Group := "networking") I get this error "Parse error (check) for entry gNetworking: Expected end of line or comma", or not work anyway Using this to verify the regex: https://regex101.com/ Following this thread: http://freeradius.1045715.n5.nabble.com/Matching-a-value-within-an-IP-subne… Using:FreeRADIUS Version 3.0.4 Any idea? Thanks!

2 1

Permission denied - MySql database
by James Ngo 26 Jan '20

26 Jan '20

Hello all, So I followed the link to setup the MySQL database to use with Freeradius https://wiki.freeradius.org/guide/SQL-HOWTO But whenever I do this mysql -u root -p radius < /etc/freeradius/sql/mysql/schema.sql The error was Bash - mysql -u root -p radius < /etc/freeradius/sql/mysql/schema.sql : Permission denied Any idea what the problem is? I have root password of the machine, of course

2 1

Access-Accept but condition isn't correct
by Marcin Romanowski 26 Jan '20

26 Jan '20

Hello, I'd like to check mac condition with ISG cisco. in users file: 192.168.10.100 Cleartext-Password := "cisco", *Calling-Station-Id := "00:50:79:66:68:01"* Cisco-Service-info = "QU;200000;D;600000", Cisco-Avpair += 'subscriber:accounting-list=BRAS', Cisco-Avpair += 'subscriber:keepalive=interval 10', Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' debug: (0) Received Access-Request Id 60 from 1.1.1.3:1645 to 1.1.1.2:1812 length 135 (0) User-Name = "192.168.10.100" (0) User-Password = "cisco" (0) Framed-IP-Address = 192.168.10.100 (0) *Calling-Station-Id = "00:50:79:66:68:00"* (0) NAS-Port-Type = Virtual (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/0" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 1.1.1.3 (0) Acct-Session-Id = "00000FDE" (0) NAS-Identifier = "ASR_1" (0) Event-Timestamp = "Jan 26 2020 18:54:55 UTC" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "192.168.10.100", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry 192.168.10.100 at line 37 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 60 from 1.1.1.2:1812 to 1.1.1.3:1645 length 0 (0) Cisco-Service-Info = "QU;200000;D;600000" (0) Cisco-AVPair = "subscriber:accounting-list=BRAS" (0) Cisco-AVPair = "subscriber:keepalive=interval 10" (0) Cisco-AVPair = "subscriber:idle-timeout-direction=inbound" (0) Finished request Calling-Station-Id is different than in config but i get Access-Accept. Where I'm doing wrong? Best Regards Marcin

1 1